Rejetto had already fixed a critical flaw in its HTTP File Server when researchers explained how Anthropic’s Mythos helped turn it into a complete exploit. Version 3.2.1 arrived on July 13, 2026; Horizon3 published the technical chain on September 30; VulnCheck observed exploitation attempts on October 1. The striking interval is not a day without an available patch, but more than two months in which some exposed installations apparently remained unprotected.
CVE-2026-61500 affects HFS 3.0.0 through 3.2.0. Horizon3 says its AI-assisted investigation connected predictable randomness, observable login values and signed session cookies to administrative code execution. The case illustrates a consequential research capability, but neither universal autonomous hacking nor a measured global infection campaign.
A signing key that could be reconstructed
HFS shares files through a web server. The 3.x branch is a TypeScript rewrite running on Node.js with Koa; the older 2.x software used Delphi. In the affected versions, HFS generated its default cookie-signing key with JavaScript’s Math.random(), a general-purpose pseudorandom generator rather than a cryptographically secure source.
A signed cookie protects integrity only while its key remains secret and unpredictable. HFS also exposed full-precision outputs from the same generator during an unauthenticated login flow. Those outputs were not independent of the startup values used to create the key: a pseudorandom generator follows a deterministic sequence from an internal state.
According to Horizon3, a specialized cryptographic-analysis agent identified three random draws used for the startup key and connected the exposed values to V8’s xorshift128+ implementation. Its reversible state made backward reconstruction possible once enough correlated observations were available. Reversibility alone does not make every application exploitable; HFS also supplied the observations and the relationship to the secret.
The demonstrated case used 12 observations and Microsoft’s Z3 satisfiability-modulo-theories solver to recover a state consistent with the constraints. An existing cookie and its message authentication code let candidate keys be checked offline. This was mathematical reconstruction, not repeated online password guessing; the cookie was signed, not encrypted, so a client could read its own session data.
With the reconstructed key, a forged cookie could claim administrator identity while retaining a valid signature. The reported chain checked for the built-in administrator account. Once administrative access was accepted, HFS’s legitimate custom server-side JavaScript feature supplied the route to arbitrary command execution. It was privileged functionality reached through forged identity, not simply malformed input exploiting a parser.
The fix changes both ends of that relationship: cryptographically secure random bytes for the signing key and a random UUID for the exposed login identifier. A strong explicitly configured signing key can mitigate part of the chain, but is not a substitute for installing 3.2.1 or a newer stable release.
What the AI contribution actually covered
A scanner could already warn about Math.random() near authentication code. The difficult question was whether that warning could be connected to observable outputs, the exact session format, recovered key material and a consequential privileged operation. Each extra step adds uncertainty and specialist work that can make an investigation uneconomical.
Horizon3 reports that Mythos linked those steps across files, framework behavior and the generator’s mathematics, then produced a working proof of concept demonstrating commands on the host. Human researchers reviewed and reproduced the finding before disclosure. A working exploit makes triage more concrete than an unexplained crash or suspicious line of code.
This was a Project Glasswing case using a custom harness with specialized agents working in parallel. People selected the target, shaped the investigation, validated the result and coordinated reporting. It was not an ordinary consumer chatbot instantly compromising an arbitrary repository without assistance.
Anthropic’s capability report likewise emphasizes complete exploitation as evidence of impact. The potential change is economic: investigations that previously required unusually expensive cryptographic expertise may become worth pursuing. The individual ingredients were familiar; the useful result was their synthesis into a verified chain.
The public case study does not provide the denominator needed to measure general productivity: total compute, failed runs, false positives and discarded findings remain important unknowns. One exceptional success cannot establish how consistently the system finds critical vulnerabilities, or whether its cost is acceptable across a larger research program.
Disclosure was followed by attempts, not a confirmed infection count
The July 13 patch preceded the September 30 technical explanation by more than two months. VulnCheck’s October 1 observations therefore concern attacks against systems whose fix was already available. They do not describe a newly disclosed flaw for which administrators had no remedy.
Reported initial traffic used China-hosted infrastructure against US systems. Later requests came from two US addresses in the same subnet that appeared to be proxies, and targeting in Japan was also reported. Hosting geography does not identify the operators or establish government sponsorship.
The detections establish attempted exploitation, not how many targets accepted a forged administrator session or executed commands. They cannot support a worldwide compromise estimate or a claim of a large, sustained campaign. Follow-on payloads and confirmed victim evidence would materially change that assessment.
Nor does the roughly one-day interval prove attackers used AI or independently solved every mathematical step overnight. They could have adapted disclosed material, worked earlier or used other information. Scanners, patch diffing, exploit frameworks and human reverse engineering already allowed rapid offensive reuse before this case.
Anthropic’s coordinated-disclosure policy generally provides maintainer notification, human review and a 90-day disclosure period, normally delaying full technical details until 45 days after a patch. This case’s patch-to-analysis interval was longer. A disclosure buffer can give operators an opportunity to update; it cannot ensure they have located every affected service.
The operational clock ends at verified deployment
Lightweight file servers can escape normal ownership and inventory processes: a temporary transfer service persists, an old container remains pinned, or a forgotten forwarding rule leaves a host reachable. A small user base does not make unauthenticated code execution less useful as an entry point.
The relevant measure is the time from an available fix until all exposed vulnerable instances are updated, isolated or removed—not the date someone assigned a patch ticket. Inventories, container registries, endpoint installations, cloud workloads and externally reachable services all matter. Verification must establish which binary or image actually answers requests.
Version distinctions are essential. CVE-2024-23692, an earlier HFS vulnerability added to CISA’s Known Exploited Vulnerabilities catalog in 2024, affected the different 2.x codebase. It is not this cryptographic chain and does not imply that every HFS installation has been compromised.
VPNs, allowlists or authenticated gateways can reduce unnecessary exposure for limited-use deployments, but do not replace upgrading. A trusted endpoint can be compromised, a configuration can change, and a presumed boundary can fail.
Logs around and after September 30 warrant review for repeated authentication activity, unexpected administrator sessions, configuration changes and unfamiliar server-side code. These are investigative leads, not universal definitive indicators. On a confirmed compromised host, an upgrade alone does not remove possible persistence in accounts, scheduled tasks, startup scripts or other services; isolation, evidence preservation, credential rotation, assessment of connected resources and rebuilding when integrity is uncertain remain relevant responses.
Better discovery must survive contact with remediation
For developers, the lesson extends beyond one function call. General-purpose pseudorandom generators should not supply authentication secrets, reset tokens, cryptographic nonces or security-sensitive session identifiers. Review must trace shared state and leaked correlated outputs: signing middleware cannot make a predictable input key secure.
AI can help follow those cross-file relationships and test whether a theoretical weakness reaches real privilege. Human validation still has to check affected versions, environmental assumptions and whether a harness demonstration generalizes to deployed systems.
Three developments will clarify the broader impact: whether observations expand from probes into sustained attacks with post-compromise payloads; whether exposed affected versions disappear; and whether later Glasswing reports remain reproducible, consequential and manageable for maintainers rather than becoming a flood of low-value findings.
The HFS result supports a narrower but substantial conclusion: an AI-assisted research system helped specialists prove an unusual end-to-end exploit. Its defensive value ultimately depends on maintainers absorbing the finding and operators converting an available fix into verified protection.
Sources
Horizon3 technical analysis · HFS 3.2.1 release · Mythos capability report · Observed attack traffic · Anthropic disclosure policy · Earlier HFS vulnerability · Original news record